graphene-os-server-infrastr.../nginx-rotate-session-ticket-keys

#!/bin/bash

set -o errexit -o nounset -o pipefail

umask 077

cd /etc/nginx/session-ticket-keys

rsync -I 2.key 1.key
rsync -I 3.key 2.key
rsync -I 4.key 3.key
head -c 80 </dev/random >new.key
rsync -I new.key 4.key
rm new.key
nginx -s reload
add session ticket key management scripts 2023-07-09 18:04:17 -04:00			`#!/bin/bash`

			`set -o errexit -o nounset -o pipefail`

			`umask 077`

			`cd /etc/nginx/session-ticket-keys`

nginx-rotate-session-ticket-keys: drop unnecessary time sync 2024-03-03 09:57:30 -05:00			`rsync -I 2.key 1.key`
			`rsync -I 3.key 2.key`
			`rsync -I 4.key 3.key`
replace urandom with random These both use the same CSPRNG on modern kernels, but random waits for CSPRNG initialization instead of only attempting to initialize it. 2024-06-17 15:03:17 -04:00			`head -c 80 </dev/random >new.key`
nginx-rotate-session-ticket-keys: drop unnecessary time sync 2024-03-03 09:57:30 -05:00			`rsync -I new.key 4.key`
add session ticket key management scripts 2023-07-09 18:04:17 -04:00			`rm new.key`
			`nginx -s reload`